feat(parser): wasm parser-module loader, hardening, and authoring target (0.24.0)

[facontidavide]

SDK PR 1b of the parser-extensibility v4 architecture (spec, PlotJuggler/pj-official-plugins#272) — follows #172 (0.22.0, merged). A second loader for the already-frozen ABI: wasmer execution, hardening, budgets, and the wasm authoring target. Ships as 0.24.0 (0.23.0 went to the symbol-provenance fix, #175).

Rebased onto main (2026-08-30) after #174–#176: the budget-aware NativeParserModule::load now keeps #175's defining-object symbol provenance (recorded_path), the CHANGELOG gained a 0.24.0 entry above 0.23.0, and root CLAUDE.md / the plugin skill's parser-module.md / kit README / ARCHITECTURE.md no longer describe wasm as unavailable. 80/80 Debug+ASAN with wasi-sdk 27 + wasmer 7.0.1.

Review rework (2026-08-30, commit 7e3b64d) — after a simplicity-first review (Claude + Codex, findings cross-verified):

• The wasm instance wrapper now has the native wrapper's fault contract: it classifies, the host records strikes / quarantines / replays through the shared ParserModuleStrikeTracker. Removes the per-instance self-recreation (claim-wide state, per-instance replay) and the loader-owned tracker that concurrent instances raced on.
• ParserModuleStrikeTracker and ParserModuleSessionBudgetTracker are thread-safe; a fault during replay now disables instead of leaving a claim quarantined forever.
• Budgets count resources under opaque reservation ids, not manifest ids (native+wasm of one source, or two generations, no longer block each other). No process-global default budget; NativeParserModule::load(path, sink) behaves exactly as in 0.22.
• WasmParserModule::load(path, options) — one signature instead of four overloads.
• Table section is now inspected and capped (default 65536 elements) by the single pj_base audit shared with pj-wasm-embed-manifest.
• Singlepass backend when available (linear compile time on untrusted input); docs state metering is an instruction budget, not a wall-clock deadline.
• Executor is in-tree only (BUILD_INTERFACE, not installed); the never-taken PJ_SDK_WITH_WASMER config block is gone. Installed/Conan packages stay wasmer-free and ship the authoring preset + tool.
• Tests: token-zero path really reaches the guest, table caps, host-driven quarantine loop, concurrent instances, concurrent budget accounting. 80/80 Debug+ASAN.

The pre-existing Conan plugin_host component gap (missing pj_parser_module_host / pj_parser_claim_catalog since 0.22) is fixed separately on main.

Exit-criterion prototype findings (spec §13 gate)

• The pinned libwasmer.a (7.0.1, static) declares but does not export wasm_module_share/obtain — the loader uses engine-owned module reuse: one compilation, store-per-bound-instance, isolated state verified.
• No creator-thread affinity observed; calls are sequential-only, host-serialized (documented in the loader header — per-store executors remain PR-2 host work).
• The lib exports the full wasmer_metering_* C API but no interrupt/epoch/deadline surface — execution limits are enforceable instruction metering (fresh allowance per guest call), not a wall-clock watchdog that couldn't fire.

Surface

Area	Contents
Loader	Validation before instantiation: manifest section (shared codec, exactly one), reactor enforced (_initialize; start/_start rejected), export names and signatures audited via the shared pj_base wasm inspector, empty frozen import allow-list (a parser module may import nothing)
Runtime	Metered store-per-instance execution; linear-memory base re-acquired at every point of use, overflow-safe bounds; splices resolve against the original host payload; shared fault taxonomy + strike tracker with quarantine replay
Caps & budgets	Artifacts must declare a linear-memory maximum (default cap 256 MiB, engine-enforced at runtime); session budgets (modules / artifact size / claims / instances / aggregate declared memory) gate admission with DECLINE, no mutation on rejection
Adversarial fixtures	Unreachable trap, metered infinite loop, memory-growth bomb, admission limits, quarantine replay → repeat-disable, plus the load-rejection matrix
Authoring	pj-wasm-embed-manifest installed CLI (embed/verify); pj_add_parser_module(... TARGETS native wasm) builds both artifacts from one source with a post-link audit — dogfooded on the toy module
Packaging	wasmer required only by the plugin_host component; plugin_sdk consumers stay wasmer-free. PJ_WASMER_ROOT gate with graceful skip; CI installs wasmer 7.0.1 and runs the wasmer-labeled tests

Verification

• 80/80 Debug+ASAN with both toolchain roots (wasi-sdk 27 + wasmer 7.0.1); graceful-skip verified for each root independently
• Installed-package consumer produced native + wasm artifacts from one source
• Process: milestone reviews with independent re-verification (1b-M1, 1b-M2), a simplification pass, and one error-path leak fix (metering middleware adapter failure) before squashing

🤖 Generated with Claude Code

[facontidavide]

Postponed — the core PR (#172) merges first on its own as 0.22.0.

This was the explicit rationale for splitting the SDK work in two: 1b is a second loader for an ABI that #172 already freezes, so deferring wasm delays wasm, never the architecture. Nothing here blocks #172, and #172 ships a complete native module story on its own.

State of this branch while it waits:

• VERSION restored to 0.23.0 with its own CHANGELOG section (the single-bump arrangement only made sense when the two merged back to back).
• Rebased on the current feat/parser-extensibility-1a; 80/80 with both toolchains (wasi-sdk 27 + wasmer 7.0.1), all review findings fixed.
• After feat(parser): extensible parser routing + functional parser modules (0.22.0) #172 merges this needs a rebase onto main and a retarget; then it is ready for review as-is.

🤖 Generated with Claude Code

[facontidavide]

Note for revival: feat/parser-extensibility-1a has since been amended (docs + skills synchronized, VERSION made a CMake configure dependency), so this branch now trails it.

When picking this back up, after #172 merges: rebase onto main, then expect doc conflicts in parser_module/README.md, pj_plugins/CLAUDE.md, and pj_plugins/docs/ARCHITECTURE.md — #172 rewrote those to describe the native-only 0.22.0 surface, so this PR's wasm sections need re-applying on top of that new baseline rather than merged blindly. The wasm authoring reference (.claude/skills/plotjuggler-plugin/references/parser-module.md) also currently documents native-only targets and will need its wasm section.

Deliberately not rebased now to avoid resolving those conflicts twice.

🤖 Generated with Claude Code